Logging to Microsoft Sentinel

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) platform built on Azure Monitor Log Analytics. Nametag logging is based on webhooks, so any activity in Nametag — verifications, shared data, and self-service account recovery events — can be streamed into a Log Analytics workspace and queried, alerted on, and correlated in Sentinel.

Note: Nametag requires valid TLS certificates to deliver webhooks. The endpoint that receives Nametag events must present a publicly trusted certificate.

How it works

Nametag sends events over HTTPS to a delivery URL. Sentinel does not accept arbitrary inbound webhooks directly, so you forward the Nametag webhook to your Log Analytics workspace using one of the standard Azure ingestion paths:

• An Azure Logic App with an HTTP request trigger and a Send Data to Log Analytics (or Azure Monitor Logs) action. This is the lowest-code option.
• An Azure Function that receives the webhook and writes to the workspace via the Logs Ingestion API.

Either endpoint becomes the delivery URL you register in Nametag. Events then appear as a custom table (for example Nametag_CL) that you can query with KQL and use in Sentinel analytics rules.

Azure configuration

1. Create (or choose) a Log Analytics workspace and note the workspace that backs your Sentinel instance.
2. Create a Logic App with an When a HTTP request is received trigger, or an Azure Function with an HTTP trigger, to receive Nametag events.
3. Add an action that writes the request body to your Log Analytics workspace (for example the Azure Log Analytics Data Collector connector in Logic Apps, or the Logs Ingestion API from a Function).
4. Copy the trigger’s HTTPS URL — this is the delivery URL you’ll give to Nametag.

Nametag configuration

In the Nametag console, go to the Webhooks section to create the webhook that sends logs to Sentinel. The Nametag API reference has documentation on webhooks.

1. In the Delivery URL field, enter the HTTPS URL of the Logic App or Function you created above.
2. For logging that has no PII, turn on Data is shared with you, Data shared with you is revoked, and A user completes self-service account recovery. For verbose logging that may include PII, you can also enable A request is created or updated.
3. To generate a test event, go to the Verifications page in the Nametag console and press New Verification.

In a few minutes, the event will appear in your Log Analytics workspace and become available to Sentinel. Query it with KQL, for example:

Nametag_CL
| sort by TimeGenerated desc

Need help wiring this up for your environment? Contact help@nametag.co.